@daloyjs/core 0.32.0 → 0.34.0

package/dist/fetch-guard.js

@@ -0,0 +1,265 @@
+/**
+ * `fetchGuard()` — SSRF-hardened wrapper around the global `fetch` for
+ * outbound calls a handler makes on behalf of a user.
+ *
+ * The classic SSRF chain documented by the
+ * [Aikido write-up](https://www.aikido.dev/blog/how-a-startups-cloud-got-taken-over-by-a-simple-form-that-sends-an-email)
+ * starts with a handler that fetches a user-supplied URL (an email avatar,
+ * a webhook target, an "import from URL" feature) and ends with the
+ * attacker pivoting through the cloud metadata service
+ * (`http://169.254.169.254/...` on AWS/Azure/DigitalOcean,
+ * `http://100.100.100.200/...` on Alibaba, `http://192.0.0.192/...` on
+ * Oracle Cloud) to steal short-lived IAM credentials.
+ *
+ * `fetchGuard()` rejects requests that resolve to any of the following
+ * address ranges unless explicitly opted-in:
+ *
+ * - Loopback: `127.0.0.0/8`, `::1` (opt in: `allowLoopback`).
+ * - RFC1918 private: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`
+ *   (opt in: `allowPrivate`).
+ * - Link-local **including every documented cloud metadata IP**:
+ *   `169.254.0.0/16`, `fe80::/10` (opt in: `allowLinkLocal`).
+ * - Unique-local IPv6: `fc00::/7` (opt in: `allowUniqueLocal`).
+ *
+ * Plus an always-deny floor that no flag can lift:
+ *
+ * - `0.0.0.0/8` (this-network), `100.64.0.0/10` (carrier-grade NAT — covers
+ *   Alibaba `100.100.100.200`), `192.0.0.0/24` (covers Oracle Cloud
+ *   `192.0.0.192`), `192.0.2.0/24`, `198.18.0.0/15`, `198.51.100.0/24`,
+ *   `203.0.113.0/24` (IANA-reserved), `224.0.0.0/4` (multicast),
+ *   `240.0.0.0/4` (reserved), `255.255.255.255` (broadcast).
+ * - IPv6: `::/128` (unspecified), `ff00::/8` (multicast), IPv4-mapped
+ *   `::ffff:0:0/96` is re-checked against the embedded IPv4 address.
+ *
+ * Redirects are followed **manually** with re-validation at each hop so
+ * an attacker cannot bypass the check via a `302 → http://169.254...`.
+ * `non-http(s)` protocols (`file:`, `ftp:`, `gopher:`, `data:`) are
+ * rejected before any network call.
+ *
+ * @since 0.34.0
+ * @module
+ */
+import { compileCidrMatcher, matchesMatcher, parseIp } from "./ip-restriction.js";
+/**
+ * Thrown by {@link fetchGuard} when an outbound request is refused. Never
+ * thrown for ordinary network failures — those bubble through unchanged
+ * so retry logic can distinguish "we refused" from "the network is sad".
+ *
+ * @since 0.34.0
+ */
+export class SsrfBlockedError extends Error {
+    url;
+    reason;
+    address;
+    constructor(url, reason, address) {
+        const where = address ? ` -> ${address}` : "";
+        super(`SSRF blocked: ${url}${where} (${reason})`);
+        this.name = "SsrfBlockedError";
+        this.url = url;
+        this.reason = reason;
+        if (address !== undefined)
+            this.address = address;
+    }
+}
+// Always-on deny matchers. No option flips these.
+const ALWAYS_DENY = [
+    "0.0.0.0/8", // "this network"
+    "100.64.0.0/10", // CGNAT (Alibaba metadata 100.100.100.200)
+    "192.0.0.0/24", // IANA reserved (Oracle metadata 192.0.0.192)
+    "192.0.2.0/24", // TEST-NET-1
+    "198.18.0.0/15", // benchmarking
+    "198.51.100.0/24", // TEST-NET-2
+    "203.0.113.0/24", // TEST-NET-3
+    "224.0.0.0/4", // multicast
+    "240.0.0.0/4", // reserved (includes 255.255.255.255)
+    "::/128", // unspecified
+    "ff00::/8", // IPv6 multicast
+];
+const LOOPBACK = ["127.0.0.0/8", "::1/128"];
+const LINK_LOCAL = ["169.254.0.0/16", "fe80::/10"];
+const PRIVATE = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+const UNIQUE_LOCAL = ["fc00::/7"];
+/**
+ * Wrap `fetch` with an SSRF-hardened guard. The returned function has
+ * the same call signature as the global `fetch` and throws
+ * {@link SsrfBlockedError} when an outbound request would target a
+ * dangerous internal address.
+ *
+ * @example
+ * ```ts
+ * import { fetchGuard } from "@daloyjs/core";
+ *
+ * const safeFetch = fetchGuard();
+ *
+ * app.route({
+ *   method: "POST", path: "/import", operationId: "import",
+ *   request: { json: z.object({ url: z.string().url() }) },
+ *   responses: { 200: { description: "ok" } },
+ *   handler: async ({ request }) => {
+ *     const { url } = await request.json();
+ *     const upstream = await safeFetch(url); // refuses 169.254.169.254
+ *     return { status: 200 as const, body: await upstream.text() };
+ *   },
+ * });
+ * ```
+ *
+ * @since 0.34.0
+ */
+export function fetchGuard(options = {}) {
+    const allowProtocols = new Set((options.allowProtocols ?? ["http:", "https:"]).map((s) => s.toLowerCase()));
+    const denyMatchers = [];
+    const allowMatchers = [];
+    const allowHosts = new Set((options.allowHosts ?? []).map((h) => h.toLowerCase()));
+    const maxRedirects = options.maxRedirects ?? 5;
+    const baseFetch = options.fetch ?? globalThis.fetch;
+    if (typeof baseFetch !== "function") {
+        throw new Error("fetchGuard(): no global fetch available; pass options.fetch.");
+    }
+    const resolveFn = options.resolve ?? createDefaultResolver();
+    for (const c of ALWAYS_DENY)
+        denyMatchers.push(compileCidrMatcher(c));
+    if (!options.allowLoopback)
+        for (const c of LOOPBACK)
+            denyMatchers.push(compileCidrMatcher(c));
+    if (!options.allowPrivate)
+        for (const c of PRIVATE)
+            denyMatchers.push(compileCidrMatcher(c));
+    if (!options.allowLinkLocal)
+        for (const c of LINK_LOCAL)
+            denyMatchers.push(compileCidrMatcher(c));
+    if (!options.allowUniqueLocal) {
+        for (const c of UNIQUE_LOCAL)
+            denyMatchers.push(compileCidrMatcher(c));
+    }
+    for (const c of options.denyAddresses ?? [])
+        denyMatchers.push(compileCidrMatcher(c));
+    for (const c of options.allowAddresses ?? [])
+        allowMatchers.push(compileCidrMatcher(c));
+    function isAddressAllowed(parsed) {
+        if (allowMatchers.some((m) => matchesMatcher(parsed, m)))
+            return true;
+        return !denyMatchers.some((m) => matchesMatcher(parsed, m));
+    }
+    async function validateUrl(url) {
+        const proto = url.protocol.toLowerCase();
+        if (!allowProtocols.has(proto)) {
+            throw new SsrfBlockedError(url.toString(), "protocol-not-allowed");
+        }
+        // URL.hostname strips brackets from IPv6 literals — perfect for parseIp.
+        const hostname = url.hostname;
+        if (!hostname) {
+            throw new SsrfBlockedError(url.toString(), "invalid-url");
+        }
+        if (allowHosts.has(hostname.toLowerCase()))
+            return;
+        const literal = parseIp(hostname);
+        if (literal) {
+            if (!isAddressAllowed(literal)) {
+                throw new SsrfBlockedError(url.toString(), "address-not-allowed", hostname);
+            }
+            return;
+        }
+        let addrs;
+        try {
+            addrs = await resolveFn(hostname);
+        }
+        catch {
+            throw new SsrfBlockedError(url.toString(), "dns-resolution-failed", hostname);
+        }
+        if (!addrs.length) {
+            throw new SsrfBlockedError(url.toString(), "dns-resolution-failed", hostname);
+        }
+        for (const a of addrs) {
+            const p = parseIp(a);
+            if (!p) {
+                throw new SsrfBlockedError(url.toString(), "dns-resolution-failed", a);
+            }
+            if (!isAddressAllowed(p)) {
+                throw new SsrfBlockedError(url.toString(), "address-not-allowed", a);
+            }
+        }
+    }
+    const guarded = async (input, init) => {
+        let request = new Request(input, init);
+        const userRedirect = (init?.redirect ?? request.redirect);
+        // Always dispatch underlying calls with redirect: "manual" so we can
+        // re-validate each Location ourselves.
+        let currentUrl;
+        try {
+            currentUrl = new URL(request.url);
+        }
+        catch {
+            throw new SsrfBlockedError(String(input), "invalid-url");
+        }
+        for (let hop = 0;; hop++) {
+            await validateUrl(currentUrl);
+            const dispatchInit = { redirect: "manual" };
+            const dispatchReq = new Request(request, dispatchInit);
+            const res = await baseFetch(dispatchReq);
+            if (!isRedirect(res.status))
+                return res;
+            if (userRedirect === "error") {
+                throw new TypeError("fetchGuard: redirect refused (redirect: error)");
+            }
+            if (userRedirect === "manual" || maxRedirects === 0)
+                return res;
+            if (hop >= maxRedirects) {
+                throw new SsrfBlockedError(currentUrl.toString(), "too-many-redirects");
+            }
+            const loc = res.headers.get("location");
+            if (!loc)
+                return res;
+            let next;
+            try {
+                next = new URL(loc, currentUrl);
+            }
+            catch {
+                throw new SsrfBlockedError(loc, "invalid-url");
+            }
+            // Per fetch spec: 303 (and 301/302 for non-GET/HEAD in practice) downgrade to GET.
+            const method = request.method.toUpperCase();
+            const shouldDowngrade = res.status === 303 ||
+                ((res.status === 301 || res.status === 302) && method !== "GET" && method !== "HEAD");
+            request = shouldDowngrade
+                ? new Request(next, {
+                    method: "GET",
+                    headers: stripBodyHeaders(request.headers),
+                    redirect: "manual",
+                    credentials: request.credentials,
+                    referrerPolicy: request.referrerPolicy,
+                })
+                : new Request(next, request);
+            currentUrl = next;
+        }
+    };
+    return guarded;
+}
+function isRedirect(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function stripBodyHeaders(headers) {
+    const out = new Headers(headers);
+    out.delete("content-length");
+    out.delete("content-type");
+    out.delete("content-encoding");
+    out.delete("content-language");
+    out.delete("content-location");
+    return out;
+}
+function createDefaultResolver() {
+    let lookupPromise = null;
+    return async (host) => {
+        if (!lookupPromise) {
+            lookupPromise = import("node:dns/promises")
+                .then((m) => m.lookup)
+                .catch(() => null);
+        }
+        const lookup = await lookupPromise;
+        if (!lookup) {
+            throw new Error("fetchGuard: no DNS resolver available on this runtime. Pass options.resolve.");
+        }
+        const results = await lookup(host, { all: true, verbatim: true });
+        return results.map((r) => r.address);
+    };
+}
+//# sourceMappingURL=fetch-guard.js.map

package/dist/fetch-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-guard.js","sourceRoot":"","sources":["../src/fetch-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAiBlF;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,GAAG,CAAS;IACZ,MAAM,CAAkB;IACxB,OAAO,CAAU;IAC1B,YAAY,GAAW,EAAE,MAAuB,EAAE,OAAgB;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,KAAK,CAAC,iBAAiB,GAAG,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,CAAC;CACF;AA6ED,kDAAkD;AAClD,MAAM,WAAW,GAAsB;IACrC,WAAW,EAAE,iBAAiB;IAC9B,eAAe,EAAE,2CAA2C;IAC5D,cAAc,EAAE,8CAA8C;IAC9D,cAAc,EAAE,aAAa;IAC7B,eAAe,EAAE,eAAe;IAChC,iBAAiB,EAAE,aAAa;IAChC,gBAAgB,EAAE,aAAa;IAC/B,aAAa,EAAE,YAAY;IAC3B,aAAa,EAAE,sCAAsC;IACrD,QAAQ,EAAE,cAAc;IACxB,UAAU,EAAE,iBAAiB;CAC9B,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAC5C,MAAM,UAAU,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAClE,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC5E,CAAC;IACF,MAAM,YAAY,GAAgB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAgB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAK,UAAU,CAAC,KAAsB,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC;IAE7D,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE;QAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE;QAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,SAAS,gBAAgB,CAAC,MAAgB;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAQ;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACrE,CAAC;QACD,yEAAyE;QACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClD,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,KAAoB,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAoB,CAAC;QAC7E,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,YAAY,GAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACzD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;YACxC,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC;YAChE,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBAAE,OAAO,GAAG,CAAC;YACrB,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACjD,CAAC;YACD,mFAAmF;YACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,eAAe,GACnB,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;YACxF,OAAO,GAAG,eAAe;gBACvB,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;oBAChB,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;oBAC1C,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC,CAAC;gBACJ,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7B,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3B,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/B,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/B,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,aAAa,GAAqH,IAAI,CAAC;IAC3I,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAC;iBACxC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAA4G,CAAC;iBAC3H,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { HttpError, BadRequestError, ValidationError, NotFoundError, Unauthorize
 export type { ProblemDetails, ProblemRenderOptions, HttpErrorOptions } from "./errors.js";
 export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
-export { readBodyLimited, safeJsonParse, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
+export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
 export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
@@ -34,6 +34,8 @@ export { every, some, except } from "./combine.js";
 export type { ExceptPredicate } from "./combine.js";
 export { ipRestriction } from "./ip-restriction.js";
 export type { IpRestrictionOptions } from "./ip-restriction.js";
+export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
+export type { FetchGuardOptions, SsrfBlockReason } from "./fetch-guard.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export type { LoadSheddingOptions, LoadSheddingSnapshot, } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
@@ -57,6 +59,6 @@ export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema,
 export type { FileFieldSchema, FileFieldOptions, FileMagicBytesOption, FileMagicBytesSignature, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
-export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
+export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1F,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,YAAY,EACV,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,EACT,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,MAAM,EACN,QAAQ,EACR,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,WAAW,GACZ,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,YAAY,IAAI,qBAAqB,EACrC,eAAe,GAChB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1F,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,YAAY,EACV,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,EACT,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,MAAM,EACN,QAAQ,EACR,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,WAAW,GACZ,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,YAAY,IAAI,qBAAqB,EACrC,eAAe,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -8,7 +8,7 @@ export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DA
 export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
-export { readBodyLimited, safeJsonParse, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
+export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
 export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
@@ -18,6 +18,7 @@ export { serializeCookie, serializeClearCookie, assertCookieAttributes, readRequ
 export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
 export { every, some, except } from "./combine.js";
 export { ipRestriction } from "./ip-restriction.js";
+export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
@@ -28,5 +29,5 @@ export { discriminator, discriminatedUnion } from "./discriminator.js";
 export { session, rotateSession, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
-export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
+export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAY7D,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA8BtE,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAQlB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAQ/B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAoBlE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAe5E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAsB/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOvE,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAWtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAY7D,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA8BtE,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAQlB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAQ/B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAoBlE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAe5E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAsB/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOvE,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAWtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}

package/dist/ip-restriction.d.ts

@@ -51,6 +51,17 @@ export interface IpRestrictionOptions {
      */
     message?: string;
 }
+/** @internal Parsed IP address (shared with `fetchGuard()`). */
+export interface ParsedIp {
+    bytes: Uint8Array;
+    family: 4 | 6;
+}
+/** @internal Compiled CIDR matcher (shared with `fetchGuard()`). */
+export interface IpMatcher {
+    family: 4 | 6;
+    prefix: number;
+    bytes: Uint8Array;
+}
 /**
  * Block or allow requests by source IP / CIDR range. In direct Web-standard
  * runtimes, pass `resolveIp` from the adapter-specific connection metadata.
@@ -72,4 +83,10 @@ export interface IpRestrictionOptions {
  * @since 0.19.0
  */
 export declare function ipRestriction(opts: IpRestrictionOptions): Hooks;
+/** @internal */
+export declare function matchesMatcher(ip: ParsedIp, m: IpMatcher): boolean;
+/** @internal */
+export declare function compileCidrMatcher(input: string): IpMatcher;
+/** @internal */
+export declare function parseIp(input: string): ParsedIp | undefined;
 //# sourceMappingURL=ip-restriction.d.ts.map

package/dist/ip-restriction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-restriction.d.ts","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGrD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,CAyB/D"}
+{"version":3,"file":"ip-restriction.d.ts","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGrD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,CAyB/D;AAaD,gBAAgB;AAChB,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAclE;AAED,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CA4B3D;AA4BD,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAI3D"}

package/dist/ip-restriction.js

@@ -64,7 +64,8 @@ function forwardedIpResolver(ctx) {
         return forwarded.split(",")[0]?.trim();
     return headers.get("x-real-ip") ?? undefined;
 }
-function matchesMatcher(ip, m) {
+/** @internal */
+export function matchesMatcher(ip, m) {
     const candidate = normalizeFamily(ip, m.family);
     if (!candidate)
         return false;
@@ -82,7 +83,8 @@ function matchesMatcher(ip, m) {
     const mask = 0xff << (8 - remaining);
     return ((candidate[fullBytes] ^ expected[fullBytes]) & mask) === 0;
 }
-function compileCidrMatcher(input) {
+/** @internal */
+export function compileCidrMatcher(input) {
     let addr = input;
     let prefixStr;
     if (input.includes("/")) {
@@ -133,7 +135,8 @@ function applyPrefixMask(bytes, prefix) {
     }
     return out;
 }
-function parseIp(input) {
+/** @internal */
+export function parseIp(input) {
     const trimmed = input.trim();
     if (trimmed.includes(":"))
         return parseIPv6(trimmed);

package/dist/ip-restriction.js.map

@@ -1 +1 @@
-{"version":3,"file":"ip-restriction.js","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyD7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS;QAC9B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC3D,OAAO;QACL,YAAY,CAAC,GAAG;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAA2B;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA0B;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,EAAY,EAAE,CAAY;IAChD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAE,GAAG,QAAQ,CAAC,SAAS,CAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,SAA6B,CAAC;IAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,IAAI,MAAM,GAAG,SAAS,CAAC;IACvB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,EAAY,EAAE,MAAa;IAClD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,sDAAsD;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,CAAC;QAC5F,IAAI,QAAQ;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,SAAS,CAAE,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,6CAA6C;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,OAAO;YACL,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC;gBAC/B,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACf,GAAG;gBACH,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;QAC7C,GAAG,UAAU;KACd,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACnC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"ip-restriction.js","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA2D7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS;QAC9B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC3D,OAAO;QACL,YAAY,CAAC,GAAG;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAA2B;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA0B;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,cAAc,CAAC,EAAY,EAAE,CAAY;IACvD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAE,GAAG,QAAQ,CAAC,SAAS,CAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,SAA6B,CAAC;IAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,IAAI,MAAM,GAAG,SAAS,CAAC;IACvB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,EAAY,EAAE,MAAa;IAClD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,sDAAsD;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,CAAC;QAC5F,IAAI,QAAQ;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,SAAS,CAAE,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,6CAA6C;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,OAAO;YACL,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC;gBAC/B,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACf,GAAG;gBACH,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;QAC7C,GAAG,UAAU;KACd,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACnC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC"}

package/dist/jwk.d.ts

@@ -11,7 +11,7 @@ export interface JwkSet {
  * `https://` URL (fetched with TTL caching), or a custom async resolver.
  */
 export type JwkSource = JwkSet | string | (() => JwkSet | Promise<JwkSet>);
-/** Per-request payload-revalidation hook (Wave 5 leftover). */
+/** Per-request payload-revalidation hook. */
 export type JwkVerifyHook = (payload: Record<string, unknown>, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
 /** Options for {@link jwk}. */
 export interface JwkOptions {

package/dist/jwk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwk.d.ts","sourceRoot":"","sources":["../src/jwk.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAS9E,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAErC,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KACvB,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAE9C,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAyGD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,KAAK,CAuG3C"}
+{"version":3,"file":"jwk.d.ts","sourceRoot":"","sources":["../src/jwk.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAS9E,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAErC,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KACvB,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAE9C,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAyGD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,KAAK,CAuG3C"}

package/dist/jwk.js

@@ -1,5 +1,5 @@
 /**
- * Wave 5 leftover: first-party `jwk()` Bearer-token middleware that refuses
+ * First-party `jwk()` Bearer-token middleware that refuses
  * symmetric algorithms outright and verifies tokens against a JWKS source
  * (static object or `https://` URL).
  *
@@ -14,9 +14,9 @@
  *   the JWKS, is rejected with `401`.
  * - JWT-header `alg` MUST be in the allowlist. When the JWK declares its own
  *   `alg`, the two MUST agree (RFC 7517 §4.4 cross-check).
- * - `exp` / `nbf` / `iat` validated on every verify (Wave 5 leftover plan).
+ * - `exp` / `nbf` / `iat` validated on every verify.
  * - JWKS URLs MUST be `https://` (refused at construction otherwise).
- * - Optional `verify(payload, ctx)` revalidation hook (Wave 5 leftover) for
+ * - Optional `verify(payload, ctx)` revalidation hook for
  *   revocation lists, token-version counters, etc.
  *
  * The middleware extracts the Bearer token, runs verification, stamps the

package/dist/jwt.d.ts

@@ -1,5 +1,5 @@
 /**
- * Wave 5 leftover: first-party `jwt()` sign + verify helpers with secure-by-default
+ * First-party `jwt()` sign + verify helpers with secure-by-default
  * algorithm discipline and time-claim validation.
  *
  * The framework refuses `alg: "none"` outright, requires an explicit algorithm
@@ -11,8 +11,8 @@
  * (with optional `iss` / `aud` checks) — none of which can be silenced in
  * production under `secureDefaults`.
  *
- * Pair with the Wave 1 webhook HMAC helpers in `@daloyjs/core` for body-bound
- * authentication, and with the Wave 5 `requireScopes()` middleware for
+ * Pair with the webhook HMAC helpers in `@daloyjs/core` for body-bound
+ * authentication, and with the `requireScopes()` middleware for
  * scope-based authorization on top of a verified JWT.
  *
  * @since 0.21.0

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,mFAAmF;AACnF,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AA+BZ,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAElE,mDAAmD;AACnD,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,EAAE,cAAc,CAAC;IACpB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;IAC5C,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,GAAG,EAAE,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtG,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAsKD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CA4FnH;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,CA4F3G"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,mFAAmF;AACnF,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AA+BZ,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAElE,mDAAmD;AACnD,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,EAAE,cAAc,CAAC;IACpB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;IAC5C,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,GAAG,EAAE,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtG,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAkLD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CA4FnH;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,CA4F3G"}

package/dist/jwt.js

@@ -1,5 +1,5 @@
 /**
- * Wave 5 leftover: first-party `jwt()` sign + verify helpers with secure-by-default
+ * First-party `jwt()` sign + verify helpers with secure-by-default
  * algorithm discipline and time-claim validation.
  *
  * The framework refuses `alg: "none"` outright, requires an explicit algorithm
@@ -11,8 +11,8 @@
  * (with optional `iss` / `aud` checks) — none of which can be silenced in
  * production under `secureDefaults`.
  *
- * Pair with the Wave 1 webhook HMAC helpers in `@daloyjs/core` for body-bound
- * authentication, and with the Wave 5 `requireScopes()` middleware for
+ * Pair with the webhook HMAC helpers in `@daloyjs/core` for body-bound
+ * authentication, and with the `requireScopes()` middleware for
  * scope-based authorization on top of a verified JWT.
  *
  * @since 0.21.0
@@ -37,7 +37,7 @@ const ASYMMETRIC = new Set([
 ]);
 const ALL_ALGS = new Set([...SYMMETRIC, ...ASYMMETRIC]);
 /**
- * Wave 8 — minimum byte length for an HS* HMAC secret. RFC 7518 §3.2
+ * Minimum byte length for an HS* HMAC secret. RFC 7518 §3.2
  * requires HS256 keys to be at least 256 bits (32 bytes). Apply the same
  * floor to HS384 / HS512 because shorter keys do not buy a meaningfully
  * stronger HMAC than HS256-with-a-256-bit-key.
@@ -81,6 +81,18 @@ function b64urlDecode(input) {
 }
 const ENC = new TextEncoder();
 const DEC = new TextDecoder();
+// JWT header/payload are attacker-controlled. Native JSON.parse already
+// assigns `__proto__` as an own property rather than mutating the prototype
+// chain, but the parsed objects often flow into user code that may do
+// `Object.assign({}, claims)` or similar — which would re-propagate
+// `constructor` / `prototype` keys. Strip those keys defensively at parse
+// time. See https://www.aikido.dev/blog/prevent-prototype-pollution.
+const JWT_FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+function jwtJsonReviver(key, value) {
+    if (JWT_FORBIDDEN_KEYS.has(key))
+        return undefined;
+    return value;
+}
 function isJsonObject(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -141,7 +153,7 @@ async function importKey(alg, material, usage) {
         if (!SYMMETRIC.has(alg)) {
             throw new JwtError("invalid_key", `jwt(): raw byte keys are only supported for HS256/HS384/HS512; got ${alg}.`);
         }
-        // Wave 8 — refuse HS-shaped secrets shorter than 32 bytes (256 bits).
+        // Refuse HS-shaped secrets shorter than 32 bytes (256 bits).
         // RFC 7518 §3.2 requires HS256 keys to be "of the same size as the hash
         // output (for instance, 256 bits for HS256)" — anything shorter is a
         // known-weak HMAC key that turns the signature into the bottleneck.
@@ -357,7 +369,7 @@ async function verifyInternal(token, r) {
     let header;
     let payload;
     try {
-        header = JSON.parse(DEC.decode(b64urlDecode(headerB64)));
+        header = JSON.parse(DEC.decode(b64urlDecode(headerB64)), jwtJsonReviver);
     }
     catch (err) {
         if (err instanceof JwtError)
@@ -365,7 +377,7 @@ async function verifyInternal(token, r) {
         throw new JwtError("invalid_token", "jwt(): header is not valid JSON.");
     }
     try {
-        payload = JSON.parse(DEC.decode(b64urlDecode(payloadB64)));
+        payload = JSON.parse(DEC.decode(b64urlDecode(payloadB64)), jwtJsonReviver);
     }
     catch (err) {
         if (err instanceof JwtError)